"I have no problem with individual agencies, or even the CTO or CIO of a state, mandating open source. I have a problem with *legislators* mandating such a thing."

As Dr. Villanueva has pointed out, the state's IT infrastructure is a public resource and should not be the intellectual property of the private sector. The CSSA correctly frames software procurement as a public policy issue, not an issue of personal discretion within or between government agencies, which have a higher responsibility to the commonwealth.

"It may even be reasonable for legislators to mandate certain principles -- for example, access to source code -- without specifying particular licenses."

"Access to the source code" is a step in the right direction but does not go far enough. The CSSA requires that the software sold to the government contain no restrictions on use, duplication, transfer, ownership or inspection. Particular licenses do not have to be specified as long as the license under which software is sold honors those fundamental freedoms.

"But even then, I'd agree with my correspondent that this is a slippery slope, and inconsistent with our principles. After all, what's the difference between legislation mandating open source, and legislation outlawing P2P file sharing?"

Quite a bit, since we're talking about *internal* government restrictions. A government employee engaging in P2P file sharing is (a) sacrificing productivity at taxpayers' expense, and more importantly, (b) potentially compromising national security (who knows what files are being traded?).

On the other hand, code which the government can neither see nor have access to inherently compromises national security to the extent that the integrity of the code is taken on faith.

You're essentially conflating restrictions on the government with restrictions on the public, concluding then that "In one case, we say that it's good, and the other that it's bad." Your example would be more consistent if the CSSA were to actually outlaw the *sale* of proprietary software, which, of course, it does not do.